[GPRS] NS: correctly pass the NS payload length to the TLV parser

This commit is contained in:
Harald Welte 2010-05-30 17:19:38 +02:00
parent f15497c1a3
commit bd33f3d0ef
1 changed files with 9 additions and 7 deletions

View File

@ -564,7 +564,8 @@ static int gprs_ns_rx_status(struct gprs_nsvc *nsvc, struct msgb *msg)
LOGP(DNS, LOGL_NOTICE, "NSEI=%u Rx NS STATUS ", nsvc->nsei);
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data, msgb_l2len(msg), 0, 0);
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
msgb_l2len(msg) - sizeof(*nsh), 0, 0);
if (rc < 0) {
LOGPC(DNS, LOGL_NOTICE, "Error during TLV Parse\n");
LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS STATUS: "
@ -592,7 +593,8 @@ static int gprs_ns_rx_reset(struct gprs_nsvc *nsvc, struct msgb *msg)
uint16_t *nsvci, *nsei;
int rc;
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data, msgb_l2len(msg), 0, 0);
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
msgb_l2len(msg) - sizeof(*nsh), 0, 0);
if (rc < 0) {
LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS RESET "
"Error during TLV Parse\n", nsvc->nsei);
@ -642,7 +644,8 @@ static int gprs_ns_rx_block(struct gprs_nsvc *nsvc, struct msgb *msg)
nsvc->state |= NSE_S_BLOCKED;
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data, msgb_l2len(msg), 0, 0);
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
msgb_l2len(msg) - sizeof(*nsh), 0, 0);
if (rc < 0) {
LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS BLOCK "
"Error during TLV Parse\n", nsvc->nsei);
@ -706,11 +709,10 @@ int gprs_ns_rcvmsg(struct gprs_ns_inst *nsi, struct msgb *msg,
#endif
}
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
msgb_l2len(msg), 0, 0);
rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data, msgb_l2len(msg), 0, 0);
msgb_l2len(msg) - sizeof(*nsh), 0, 0);
if (rc < 0) {
LOGP(DNS, LOGL_ERROR, "Rx NS RESET Error during "
"TLV Parse\n");
LOGP(DNS, LOGL_ERROR, "Rx NS RESET Error %d during "
"TLV Parse\n", rc);
return rc;
}
if (!TLVP_PRESENT(&tp, NS_IE_CAUSE) ||